Manage SaaSKit sessions

Store, validate, refresh, and revoke a session. Then stop.

Guardrails

• MUST validate the access token on every protected request.
• MUST return 401 when refresh fails. MUST NOT continue the request.
• MUST NOT write login, callback, or the logout redirect. Name implement-saaskit instead.
• MUST NOT put the access token in localStorage.

Gotchas